Vulnerabilities > CVE-2013-0156 - Improper Input Validation vulnerability in multiple products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Buffer Overflow via Environment Variables This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
- Server Side Include (SSI) Injection An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
- Cross Zone Scripting An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
- Cross Site Scripting through Log Files An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
- Command Line Execution through SQL Injection An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Exploit-Db
description Ruby on Rails Known Secret Session Cookie Remote Code Execution. CVE-2013-0156. Remote exploits for multiple platform id EDB-ID:27527 last seen 2016-02-03 modified 2013-08-12 published 2013-08-12 reporter metasploit source https://www.exploit-db.com/download/27527/ title Ruby on Rails Known Secret Session Cookie Remote Code Execution description Ruby on Rails XML Processor YAML Deserialization Code Execution. CVE-2013-0156. Remote exploits for multiple platform id EDB-ID:24019 last seen 2016-02-02 modified 2013-01-10 published 2013-01-10 reporter metasploit source https://www.exploit-db.com/download/24019/ title Ruby on Rails XML Processor YAML Deserialization Code Execution
Metasploit
description This module exploits a remote code execution vulnerability in the XML request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This module has been tested across multiple versions of RoR 3.x and RoR 2.x The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated. id MSF:EXPLOIT/MULTI/HTTP/RAILS_XML_YAML_CODE_EXEC last seen 2020-05-29 modified 2020-02-18 published 2013-01-10 references reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/rails_xml_yaml_code_exec.rb title Ruby on Rails XML Processor YAML Deserialization Code Execution description This module exploits a remote code execution vulnerability in the JSON request processor of the Ruby on Rails application framework. This vulnerability allows an attacker to instantiate a remote object, which in turn can be used to execute any ruby code remotely in the context of the application. This vulnerability is very similar to CVE-2013-0156. This module has been tested successfully on RoR 3.0.9, 3.0.19, and 2.3.15. The technique used by this module requires the target to be running a fairly recent version of Ruby 1.9 (since 2011 or so). Applications using Ruby 1.8 may still be exploitable using the init_with() method, but this has not been demonstrated. id MSF:EXPLOIT/MULTI/HTTP/RAILS_JSON_YAML_CODE_EXEC last seen 2020-05-29 modified 2017-07-24 published 2013-01-29 references https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0333 reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/rails_json_yaml_code_exec.rb title Ruby on Rails JSON Processor YAML Deserialization Code Execution description This module implements Remote Command Execution on Ruby on Rails applications. Prerequisite is knowledge of the "secret_token" (Rails 2/3) or "secret_key_base" (Rails 4). The values for those can be usually found in the file "RAILS_ROOT/config/initializers/secret_token.rb". The module achieves RCE by deserialization of a crafted Ruby Object. id MSF:EXPLOIT/MULTI/HTTP/RAILS_SECRET_DESERIALIZATION last seen 2020-05-21 modified 2018-07-09 published 2013-07-26 references reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/rails_secret_deserialization.rb title Ruby on Rails Known Secret Session Cookie Remote Code Execution description This module attempts to identify Ruby on Rails instances vulnerable to an arbitrary object instantiation flaw in the XML request processor. id MSF:AUXILIARY/SCANNER/HTTP/RAILS_XML_YAML_SCANNER last seen 2020-03-01 modified 2020-02-18 published 2013-01-09 references reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/auxiliary/scanner/http/rails_xml_yaml_scanner.rb title Ruby on Rails XML Processor YAML Deserialization Scanner
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_SERVER_2_2_1.NASL description The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.2.1. It is, therefore, affected by the following vulnerabilities : - A type casting issue exists in Ruby on Rails due to improper handling of XML parameters. A remote attacker can exploit this issue to execute arbitrary code through either the Profile Manager or Wiki Server components. (CVE-2013-0156) - A type casting issue exists in Ruby on Rails due to improper handling of JSON data. A remote attacker can exploit this to execute arbitrary code through the Wiki Server component. (CVE-2013-0333) last seen 2020-06-01 modified 2020-06-02 plugin id 64476 published 2013-02-05 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/64476 title Mac OS X : OS X Server < 2.2.1 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(64476); script_version("1.6"); script_cvs_date("Date: 2018/07/14 1:59:36"); script_cve_id("CVE-2013-0156", "CVE-2013-0333"); script_bugtraq_id(57187, 57575); script_xref(name:"APPLE-SA", value:"APPLE-SA-2013-02-04-1"); script_name(english:"Mac OS X : OS X Server < 2.2.1 Multiple Vulnerabilities"); script_summary(english:"Checks OS X Server version."); script_set_attribute( attribute:"synopsis", value: "The remote host is missing an update for OS X Server that fixes two security issues." ); script_set_attribute( attribute:"description", value: "The remote Mac OS X 10.8 host has a version of OS X Server installed that is prior to 2.2.1. It is, therefore, affected by the following vulnerabilities : - A type casting issue exists in Ruby on Rails due to improper handling of XML parameters. A remote attacker can exploit this issue to execute arbitrary code through either the Profile Manager or Wiki Server components. (CVE-2013-0156) - A type casting issue exists in Ruby on Rails due to improper handling of JSON data. A remote attacker can exploit this to execute arbitrary code through the Wiki Server component. (CVE-2013-0333)" ); script_set_attribute(attribute:"see_also", value:"http://support.apple.com/kb/HT5644"); script_set_attribute(attribute:"see_also", value:"http://lists.apple.com/archives/security-announce/2013/Feb/msg00001.html"); script_set_attribute(attribute:"see_also", value:"http://www.securityfocus.com/archive/1/525572/30/0/threaded"); script_set_attribute(attribute:"solution", value:"Upgrade to Mac OS X Server v2.2.1 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Ruby on Rails JSON Processor YAML Deserialization Code Execution'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2013/01/08"); script_set_attribute(attribute:"patch_publication_date", value:"2013/02/04"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/05"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:mac_os_x_server"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"MacOS X Local Security Checks"); script_copyright(english:"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc."); script_dependencies("macosx_server_services.nasl"); script_require_keys("Host/local_checks_enabled", "Host/MacOSX/Version", "MacOSX/Server/Version"); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED); os = get_kb_item("Host/MacOSX/Version"); if (!os) audit(AUDIT_OS_NOT, "Mac OS X"); if (!ereg(pattern:"Mac OS X 10\.8([^0-9]|$)", string:os)) audit(AUDIT_OS_NOT, "Mac OS X 10.8"); version = get_kb_item_or_exit("MacOSX/Server/Version"); fixed_version = "2.2.1"; if (ver_compare(ver:version, fix:fixed_version, strict:FALSE) == -1) { if (report_verbosity > 0) { report = '\n Installed version : ' + version + '\n Fixed version : ' + fixed_version + '\n'; security_hole(port:0, extra:report); } else security_hole(0); } else audit(AUDIT_INST_VER_NOT_VULN, "OS X Server", version);NASL family Fedora Local Security Checks NASL id FEDORA_2013-0686.NASL description Fix for CVE-2013-0155 and CVE-2013-0156. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-01-23 plugin id 63657 published 2013-01-23 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63657 title Fedora 16 : rubygem-actionpack-3.0.10-10.fc16 / rubygem-activemodel-3.0.10-2.fc16 / etc (2013-0686) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2013-0154.NASL description Updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Subscription Asset Manager. The Red Hat Security Response Team has rated this update as having critical security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. Active Record implements object-relational mapping for accessing database entries using objects. Active Support provides support and utility classes used by the Ruby on Rails framework. Multiple flaws were found in the way Ruby on Rails performed XML parameter parsing in HTTP requests. A remote attacker could use these flaws to execute arbitrary code with the privileges of a Ruby on Rails application, perform SQL injection attacks, or bypass the authentication using a specially-created HTTP request. (CVE-2013-0156) Red Hat is aware that a public exploit for the CVE-2013-0156 issues is available that allows remote code execution in applications using Ruby on Rails. Multiple input validation vulnerabilities were discovered in rubygem-activerecord. A remote attacker could possibly use these flaws to perform a SQL injection attack against an application using rubygem-activerecord. (CVE-2012-2661, CVE-2012-2695, CVE-2012-6496, CVE-2013-0155) Multiple input validation vulnerabilities were discovered in rubygem-actionpack. A remote attacker could possibly use these flaws to perform a SQL injection attack against an application using rubygem-actionpack and rubygem-activerecord. (CVE-2012-2660, CVE-2012-2694) Multiple cross-site scripting (XSS) flaws were found in rubygem-actionpack. A remote attacker could use these flaws to conduct XSS attacks against users of an application using rubygem-actionpack. (CVE-2012-3463, CVE-2012-3464, CVE-2012-3465) A flaw was found in the HTTP digest authentication implementation in rubygem-actionpack. A remote attacker could use this flaw to cause a denial of service of an application using rubygem-actionpack and digest authentication. (CVE-2012-3424) Users are advised to upgrade to these updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord packages, which resolve these issues. Katello must be restarted ( last seen 2020-06-01 modified 2020-06-02 plugin id 64076 published 2013-01-24 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/64076 title RHEL 6 : Ruby on Rails in Subscription Asset Manager (RHSA-2013:0154) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201412-28.NASL description The remote host is affected by the vulnerability described in GLSA-201412-28 (Ruby on Rails: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could execute arbitrary code or cause a Denial of Service condition. Furthermore, a remote attacker may be able to execute arbitrary SQL commands, change parameter names for form inputs and make changes to arbitrary records in the system, bypass intended access restrictions, render arbitrary views, inject arbitrary web script or HTML, or conduct cross-site request forgery (CSRF) attacks. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 79981 published 2014-12-15 reporter This script is Copyright (C) 2014-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/79981 title GLSA-201412-28 : Ruby on Rails: Multiple vulnerabilities NASL family Debian Local Security Checks NASL id DEBIAN_DLA-172.NASL description Import patches 633974b2759d9b92 and 4540e7102b803624 from uptream to remove symbol and YAML coercion from the XML parser. NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2015-03-26 plugin id 82157 published 2015-03-26 reporter This script is Copyright (C) 2015-2020 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/82157 title Debian DLA-172-1 : libextlib-ruby security update NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_CA5D327259E311E2853B00262D5ED8EE.NASL description Ruby on Rails team reports : Two high-risk vulnerabilities have been discovered : (CVE-2013-0155) There is a vulnerability when Active Record is used in conjunction with JSON parameter parsing. Due to the way Active Record interprets parameters in combination with the way that JSON parameters are parsed, it is possible for an attacker to issue unexpected database queries with last seen 2020-06-01 modified 2020-06-02 plugin id 63435 published 2013-01-09 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63435 title FreeBSD : rubygem-rails -- multiple vulnerabilities (ca5d3272-59e3-11e2-853b-00262d5ed8ee) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2013-0153.NASL description Updated rubygem-actionpack, rubygem-activesupport, ruby193-rubygem-actionpack, and ruby193-rubygem-activesupport packages that fix multiple security issues are now available for Red Hat OpenShift Enterprise 1.0. The Red Hat Security Response Team has rated this update as having critical security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. Active Support provides support and utility classes used by the Ruby on Rails framework. Multiple flaws were found in the way Ruby on Rails performed XML parameter parsing in HTTP requests. A remote attacker could use these flaws to execute arbitrary code with the privileges of a Ruby on Rails application, perform SQL injection attacks, or bypass the authentication using a specially-created HTTP request. (CVE-2013-0156) Red Hat is aware that a public exploit for the CVE-2013-0156 issues is available that allows remote code execution in applications using Ruby on Rails. All users of Red Hat OpenShift Enterprise are advised to upgrade to these updated packages, which correct these issues. For Red Hat OpenShift Enterprise administrators, the openshift-broker and openshift-console services must be restarted for this update to take effect. Users of OpenShift are advised to update their own applications that are running Ruby on Rails. last seen 2020-06-01 modified 2020-06-02 plugin id 119429 published 2018-12-06 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119429 title RHEL 6 : Ruby on Rails (RHSA-2013:0153) NASL family SuSE Local Security Checks NASL id OPENSUSE-2013-106.NASL description This update updates the RubyOnRails 2.3 stack to 2.3.16, also this update updates the RubyOnRails 3.2 stack to 3.2.11. Security and bugfixes were done, foremost: CVE-2013-0333: A JSON sql/code injection problem was fixed. CVE-2012-5664: A SQL Injection Vulnerability in Active Record was fixed. CVE-2012-2695: A SQL injection via nested hashes in conditions was fixed. CVE-2013-0155: Unsafe Query Generation Risk in Ruby on Rails was fixed. CVE-2013-0156: Multiple vulnerabilities in parameter parsing in Action Pack were fixed. last seen 2020-06-05 modified 2014-06-13 plugin id 74881 published 2014-06-13 reporter This script is Copyright (C) 2014-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/74881 title openSUSE Security Update : ruby (openSUSE-SU-2013:0278-1) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_CDA566A02DF04EB0B70EED7A6FB0AB3C.NASL description Moses Mendoza reports : A vulnerability found in Puppet could allow an authenticated client to cause the master to execute arbitrary code while responding to a catalog request. Specifically, in order to exploit the vulnerability, the puppet master must be made to invoke the last seen 2020-06-01 modified 2020-06-02 plugin id 65542 published 2013-03-14 reporter This script is Copyright (C) 2013-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/65542 title FreeBSD : puppet27 and puppet -- multiple vulnerabilities (cda566a0-2df0-4eb0-b70e-ed7a6fb0ab3c) NASL family Fedora Local Security Checks NASL id FEDORA_2013-0568.NASL description Fix for CVE-2013-0155 and CVE-2013-0156. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-01-21 plugin id 63635 published 2013-01-21 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63635 title Fedora 18 : rubygem-actionpack-3.2.8-2.fc18 / rubygem-activerecord-3.2.8-3.fc18 / etc (2013-0568) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-2604.NASL description It was discovered that Rails, the Ruby web application development framework, performed insufficient validation on input parameters, allowing unintended type conversions. An attacker may use this to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on the application. last seen 2020-03-17 modified 2013-01-10 plugin id 63457 published 2013-01-10 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63457 title Debian DSA-2604-1 : rails - insufficient input validation NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2013-001.NASL description The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-001 applied. This update contains numerous security-related fixes for the following components : - Apache - CoreTypes (10.7 only) - International Components for Unicode - Identity Services (10.7 only) - ImageIO - Messages Server (Server only) - PDFKit - Podcast Producer Server (Server only) - PostgreSQL (Server only) - Profile Manager (10.7 Server only) - QuickTime - Ruby (10.6 Server only) - Security - Software Update - Wiki Server (10.7 Server only) Note that the update also runs a malware removal tool that will remove the most common variants of malware. last seen 2020-06-01 modified 2020-06-02 plugin id 65578 published 2013-03-15 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/65578 title Mac OS X Multiple Vulnerabilities (Security Update 2013-001) NASL family Fedora Local Security Checks NASL id FEDORA_2013-0635.NASL description Fix for CVE-2013-0155 and CVE-2013-0156. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-03-17 modified 2013-01-23 plugin id 63654 published 2013-01-23 reporter This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/63654 title Fedora 17 : rubygem-actionpack-3.0.11-8.fc17 / rubygem-activemodel-3.0.11-2.fc17 / etc (2013-0635)
Packetstorm
data source https://packetstormsecurity.com/files/download/119872/rails_json_yaml_code_exec.rb.txt id PACKETSTORM:119872 last seen 2016-12-05 published 2013-01-29 reporter egypt source https://packetstormsecurity.com/files/119872/Ruby-on-Rails-JSON-Processor-YAML-Deserialization-Code-Execution.html title Ruby on Rails JSON Processor YAML Deserialization Code Execution data source https://packetstormsecurity.com/files/download/119471/rails_xml_yaml_code_exec.rb.txt id PACKETSTORM:119471 last seen 2016-12-05 published 2013-01-11 reporter H D Moore source https://packetstormsecurity.com/files/119471/Ruby-On-Rails-XML-Processor-YAML-Deserialization-Code-Execution.html title Ruby On Rails XML Processor YAML Deserialization Code Execution
Redhat
| advisories |
| ||||||||||||
| rpms |
|
Saint
| bid | 57187 |
| description | Ruby on Rails XML Processor YAML Deserialization |
| id | web_dev_rubyonrails |
| osvdb | 89026 |
| title | ruby_on_rails_yaml_deserialization |
| type | remote |
Seebug
bulletinFamily exploit description No description provided by source. id SSV:77757 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-77757 title Ruby on Rails XML Processor YAML Deserialization Code Execution bulletinFamily exploit description No description provided by source. id SSV:60615 last seen 2017-11-19 modified 2013-02-03 published 2013-02-03 reporter Root source https://www.seebug.org/vuldb/ssvid-60615 title Ruby on Rails JSON Processor YAML Deserialization Code Execution
The Hacker News
| id | THN:104ADC1CB2EE1C258A129E663822F952 |
| last seen | 2017-01-08 |
| modified | 2013-06-03 |
| published | 2013-05-30 |
| reporter | Mohit Kumar |
| source | http://thehackernews.com/2013/05/ruby-on-rails-exploit-could-hijack.html |
| title | Ruby on Rails exploit could hijack unpatched servers for botnet |
References
- https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain
- http://www.debian.org/security/2013/dsa-2604
- http://rhn.redhat.com/errata/RHSA-2013-0154.html
- http://www.kb.cert.org/vuls/id/628463
- http://rhn.redhat.com/errata/RHSA-2013-0155.html
- http://www.insinuator.net/2013/01/rails-yaml/
- https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
- http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
- http://www.kb.cert.org/vuls/id/380039
- http://rhn.redhat.com/errata/RHSA-2013-0153.html
- http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
- http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
- https://puppet.com/security/cve/cve-2013-0156